HKEX ESG report outline (Listing Rules Appendix C2, including Part D climate disclosures)

Structure (6 sections)

1. 1. Part B: governance structure, reporting principles and reporting boundary (mandatory)

   Answer each of the three mandatory disclosures directly rather than merging them into one overview. Governance structure: board oversight of ESG matters, the ESG management approach and strategy, and how progress is reviewed against relevance with an explanation of how targets are set. Reporting principles: how materiality, quantitative and consistency are applied — the quantitative principle requires disclosure of the standards, methodologies, assumptions and conversion factor sources used, the sentence most often skipped and most often queried. Reporting boundary: which entities and operations the report covers, the process for selecting that boundary, and an explanation whenever it changes.

   Evidence to attach

   • · Terms of reference and minutes evidencing board oversight of ESG
   • · Materiality assessment process record including stakeholder involvement
   • · Quantitative basis note (standards, methodologies, assumptions, conversion factor sources)
   • · Reporting boundary list and the explanation of any change from the prior year

   Common pitfalls

   • · Glossing over the quantitative principle and omitting conversion factor sources, leaving emissions figures unverifiable
   • · A reporting boundary that differs from the annual report consolidation without explanation
   • · Describing the day-to-day work of an ESG working group in place of board oversight

2. 2. Part C environmental: A1 emissions, A2 use of resources, A3 environment and natural resources, A4 climate change

   Write the general disclosure and the KPIs aspect by aspect. For AI and hardware companies the workload concentrates in A1 (air and greenhouse gas emissions, hazardous and non-hazardous waste including e-waste and retired GPUs and servers) and A2 (total energy consumption by type and intensity, water consumption and intensity, packaging materials). Two version points: KPIs A1.2 and A4.1 were repealed in the version effective 1 January 2025, so old templates will carry retired indicators; and Scope 1 and Scope 2 greenhouse gas emissions are mandatory while Scope 3 sits under comply-or-explain, with the categories covered to be stated where it is disclosed. Intensity metrics must name the denominator (revenue, headcount or rack count) and keep it consistent year to year.

   Evidence to attach

   • · Energy consumption ledger by type and intensity calculations (stating the denominator)
   • · Water consumption ledger including data-centre cooling water, with any sourcing constraints noted
   • · Hazardous and non-hazardous waste ledgers, with disposal certificates for e-waste and retired servers and GPUs
   • · Scope 1 and Scope 2 calculation workpapers and a statement of the Scope 3 categories included
   • · Legal confirmation of compliance with emissions-related laws

   Common pitfalls

   • · Reusing a 2024 template so the repealed A1.2 and A4.1 still appear
   • · Changing the intensity denominator between years (revenue this year, headcount next), destroying comparability
   • · Excluding colocated data-centre energy and water and reporting office figures only
   • · E-waste disposal supported only by an internal log with no third-party certificate

3. 3. Part C social: B1–B8 (employment, health and safety, development and training, labour standards, supply chain, product responsibility, anti-corruption, community investment)

   Work aspect by aspect. Three carry the most weight for an AI company. B5 supply chain management: how supplier environmental and social risks are identified, how many suppliers there are and where, and the green procurement practices in place — data labelling vendors and contract manufacturers should be explicitly in scope. B6 product responsibility: beyond recalls and complaints, KPI B6.3 on intellectual property practices and B6.5 on customer data protection are substantive for AI companies, and the provenance of training data rights and the isolation of customer data belong here. B4 labour standards: preventing child and forced labour across the outsourced labour chain. Reuse existing compliance outputs directly — personal information protection audit conclusions, algorithm filings and security assessments all support B6.

   Evidence to attach

   • · Workforce data by gender, employment type, age group and region, with turnover calculations
   • · Supplier register (count, regional distribution), onboarding and assessment records, and the green procurement policy
   • · Labour compliance checks on outsourced data labelling vendors
   • · Register of training data rights provenance and the IP management policy
   • · Customer data protection measures and the conclusions of the personal information protection compliance audit
   • · Anti-corruption training records and the whistleblowing case log

   Common pitfalls

   • · Counting only direct contracting parties in the supply chain aspect and excluding outsourced labelling and content moderation workers
   • · Answering B6.3 with "we respect intellectual property" and never addressing the substantive question of training data rights provenance
   • · Workforce figures that do not reconcile with the headcount disclosed in the annual report

4. 4. Part D: climate-related governance and strategy

   Part D is modelled on IFRS S2: terms in bold italics take their meaning from Appendix A of IFRS S2, and issuers should refer to the application guidance in Appendix B and to HKEX implementation guidance; HKEX states that an ESG report prepared in compliance with IFRS S1 and IFRS S2 is treated as having complied with Part D. Governance covers the oversight body and management responsibilities (paragraph 19); strategy covers the climate risks and opportunities identified (paragraph 20), their effects on the business model and value chain (paragraph 21), their effects on strategy and decision-making and progress against previously disclosed plans (paragraphs 22-23), and their current and anticipated effects on financial position, performance and cash flows (paragraphs 24-25); and do not drop paragraph 26 on climate resilience and scenario analysis, which stands separately from all of those and is the item most often missing when an older outline is reused - it can be drafted straight from the climate resilience section of tmpl-issb-sustainability-report-outline. Application is tiered in three layers, not two. First, paragraph 16(1) puts Part D on a comply-or-explain basis (an issuer that has not disclosed must give considered reasons), in the version applying to financial years beginning on or after 1 January 2025. Second, paragraph 17(1) is a mandatory carve-out that binds every issuer: Scope 1 and Scope 2 greenhouse gas emissions under paragraphs 28(a), 28(b) and 29 must be disclosed on a mandatory basis and cannot be "explained" away — so reading the whole part as comply-or-explain is wrong. Third, paragraph 17(2) makes all of Part D mandatory for Hang Seng Composite LargeCap Index (HSCLI) constituents for financial years commencing on or after 1 January 2026, its note limiting this to issuers that were constituents throughout the year immediately prior to the reporting year — and once inside that perimeter an issuer stays there even if it later leaves the index. Calibrate preparation accordingly.

   Evidence to attach

   • · Board or committee agendas and minutes covering climate topics
   • · Climate risk and opportunity register with the horizon definitions
   • · Workpapers for current-period financial effects and the assumptions behind anticipated effects
   • · Climate resilience assessment and scenario analysis method note (scenario source, parameters, horizons, coverage, date performed)
   • · Tracking record of index constituent status (to determine entry into the mandatory perimeter)

   Common pitfalls

   • · Skipping the whole part on comply-or-explain grounds without giving considered reasons — the Code requires reasons, not silence
   • · Not tracking index constituent status and discovering the mandatory perimeter only in the year it bites
   • · Part D duplicating and contradicting the Part C Aspect A4 climate content

5. 5. Part D: climate-related risk management, metrics and targets

   Risk management: the processes to identify, assess, prioritise and monitor climate risks and how they integrate with overall risk management. Metrics: Scope 1 and Scope 2 greenhouse gas emissions are mandatory (measured under the GHG Protocol Corporate Standard, with Scope 2 disclosed on a location basis and contractual instruments such as green power explained), while Scope 3 is comply-or-explain but the categories included must be stated by reference to the GHG Protocol Scope 3 Standard; also disclose transition and physical risk exposure, capital deployed to climate opportunities, internal carbon price and any remuneration link. Targets: the metric basis, base year, coverage and progress. Use the two built-in reliefs properly: climate-opportunity information may be omitted where the three commercial-sensitivity conditions are met, and quantitative information on current or anticipated financial effects may be omitted where the effects are not separately identifiable, measurement uncertainty is too high, or the issuer lacks the skills, capabilities or resources — with reasons, qualitative information and combined-effect information provided instead. Industry-based metrics (paragraph 36) are encouraged only.

   Evidence to attach

   • · Scope 1 and Scope 2 workpapers including the location-based figure and contractual instrument notes
   • · List of Scope 3 categories included and reasons for exclusions
   • · Calculations of assets or revenue exposed to transition and physical risk
   • · Detail of climate-related capital deployment and the internal carbon price policy
   • · Written reasons and qualitative narrative where a relief or the exemption from quantification is used

   Common pitfalls

   • · Giving only the market-based Scope 2 figure when the Code requires the location-based one
   • · Writing "not yet disclosed" for Scope 3 with neither the categories nor a reason
   • · Invoking the relief from quantification without giving reasons, qualitative information or combined-effect information
   • · Treating the paragraph 36 industry metrics as mandatory and spending heavily on them

6. 6. Pre-IPO data readiness and first-time disclosure

   Scope 1 and Scope 2 emissions are mandatory regardless of size, so at least one full financial year of electricity and fuel records is needed before listing. Where the listing vehicle draws its compute mainly from rented cloud and colocation, the data-access terms must be in the contract in advance (account-level consumption or carbon data, delivery frequency, audit cooperation), or the first post-listing ESG report will simply lack the data. First-time disclosure also needs the materiality assessment record, the reporting boundary note, and a consistency check against the environmental and social statements in the listing document. If index inclusion in the Hang Seng Composite LargeCap Index is plausible after listing, prepare the whole of Part D in advance, including scenario analysis and anticipated financial effects.

   Evidence to attach

   • · A full financial year of electricity and fuel ledgers
   • · Data provision clauses in cloud and colocation contracts (or side letters)
   • · Materiality assessment process record
   • · Consistency check between the listing document and the ESG report
   • · First-time disclosure gap analysis and remediation plan

   Common pitfalls

   • · Failing to agree data provision with cloud and colocation providers before listing, then discovering after period end that consumption data is unobtainable
   • · A listing document claiming carbon emissions are "managed to international standards" while the first ESG report cannot even state the Scope 2 basis
   • · Scheduling ESG report preparation for after listing, leaving an irrecoverable data gap in the first financial year